Ai

Josh chats with Xe Iaso, the creator of Anubis the web AI firewall. We discuss how Anubis is tackling bots and scrapers. The discussion around the scrapers is fascinating and challenging, these things are everywhere and don’t behave very nicely. There’s also discussion about running a successful open source project. Xe has a lot of experience to share with us, you’re going to learn something new with this one. Episode Links Xe Anubis Blog Odd number of cores blog Common Crawl This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player. ...

I keep seeing commentary about AI making open source dependencies obsolete. The idea is that instead of using an open source dependency, the AI will just write all the code you need. No more need for that random person in Nebraska. They can finally take a well deserved break! Some people think this is inevitable, some think it’s hogwash. I like to take the stance of disliking everything equally. But to better understand all of this, let’s break it up into a few possible outcomes. There are 4 basic things that could happen if we take these arguments to their ridiculous extremes. ...

Daniel Stenberg, the maintainer of Curl, discusses the increase in AI security reports that are wasting the time of maintainers. We discuss Curl’s new policy of banning the bad actors while establishing some pretty sane AI usage guidelines. We chat about how this low-effort, high-impact abuse pattern is a denial-of-service attack on the curl project (and other open source projects too). Episode Links Daniel Curl Curl project founder snaps over deluge of time-sucking AI slop bug reports Curl AI usage guide This episode is also available as a podcast, search for “Open Source Security” on your favorite podcast player. ...

It’s the 2023 Christmas Spectacular! Josh and Kurt talk about what would happen if Santa starts using AI to judge which children are naughty and nice. There’s some fun in this one, but it does get pretty real. While we tried to discuss Santa using AI, the reality is this sort of AI is coming for many of us. AI will be making decisions for all of us in the near future (if it isn’t already). While less fun than we had hoped for, it’s an important conversation. ...

Josh and Kurt talk about some of the efforts to measure and understand open source. There are projects like the OpenSSF Scorecard. We want to measure open source for some idea of quality. Is AI generated code better than a random open source project found on GitHub? Can we track the countries contributors are from? These are all interesting problems that everyone will have to deal with soon. https://traffic.libsyn.com/opensourcesecuritypodcast/Episode_384_Whats_next_for_open_source.mp3 Show Notes OpenSSF Scorecard

Josh and Kurt talk about the Open Source Summit in Vancouver. Josh was there and we pick on two observations. Firstly that security keeps trying to use fear as a feature, except it doesn’t work. Secondly we discuss AI and how people are talking about it. It is changing things, how much is yet to be seen. https://traffic.libsyn.com/opensourcesecuritypodcast/Episode_376_Open_Source_Summit_who_built_your_open_source_and_AI.mp3 Show Notes SLSA FRSCA S2C2F MSI leak Intel microcode Tom Scott AI Video

Josh and Kurt talk about AI driven comments. We live in a world of massive confusion and disruption where what is true and false, real and fake, are often widely debated. As AI grows and evolves what does it mean for this future? We don’t really have any answers, but we ask a lot of questions. This isn’t easy, nor will it be solved quickly, but solving it is not optional. ...

Josh and Kurt start this one by explaining how the Twitter hacker was just a dumb criminal (most criminals are dumb). We then discuss the new GPT-3 AI that can create text. How we create, and how social media is doing everything it can to weaponize our attention. It’s not a fight humanity is winning. https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_207_Weaponized_attention.mp3 Show Notes GPT-3 AI Blipverts Show Tags #weaponizedattention #GPT-3 #GPT3